SeRegisterLogonSessionTerminatedRoutine

NTSTATUS __fastcall SeRegisterLogonSessionTerminatedRoutine(VOID *a1){
  VOID **PoolWithTag; 
  _ETHREAD *CurrentThread; 

  if( !a1 )
    return -1073741811;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x10ui64, 1397122387i64);
  if( !PoolWithTag )
    return -1073741670;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquireFastMutexUnsafe((PFAST_MUTEX)((char *)&stru_140CF2E80 + 5144));
  *PoolWithTag = SeFileSystemNotifyRoutinesHead;
  PoolWithTag[1] = a1;
  SeFileSystemNotifyRoutinesHead = PoolWithTag;
  ExReleaseFastMutexUnsafe((PFAST_MUTEX)((char *)&stru_140CF2E80 + 5144));
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  return 0;
}

Referenced by: